Description
projectserver/logon/pdsrequest.asp in Microsoft Project Server 2003 allows remote authenticated users to obtain the MSProjectUser password for a SQL database via a GetInitializationData request, which includes the information in the UserName and Password tags of the response.
References
- 2047 third-party-advisory
- 20061214 Project Server 2003 - Credential Disclosure mailing-list
- 1017388 vdb-entry
- 23391 third-party-advisory
- 20061214 Project Server 2003 - Credential Disclosure mailing-list
- projectserver-pdsrequest-info-disclosure(30905) vdb-entry
- ADV-2006-5038 vdb-entry
- 21611 vdb-entry