CVE-2006-6617: projectserver/logon/pdsrequest.asp in Microsoft Project Server 2003 allows remote authenticated users to ob...

Security readout for executives and security teams

Microsoft Project Server 2003 could disclose the SQL database username and password used by MSProjectUser to a remote authenticated user. This is a credential exposure issue, not an unauthenticated takeover claim. If an old Project Server instance remains reachable, the disclosed database credentials could increase business risk. Exposure is likely limited to organizations still running Microsoft Project Server 2003 with authenticated users able to access the Project Data Service endpoint. Internet exposure would raise urgency, but the provided sources do not confirm typical deployment patterns or affected version ranges beyond Project Server 2003. Prioritize if Project Server 2003 is still in use, especially if accessible beyond a tightly controlled internal network. The product is legacy, the issue exposes database credentials, and compensating controls may be the practical path if no vendor-supported fix is available. Mitigation focus: Check Microsoft or vendor guidance for Project Server 2003 remediation or retirement options.; Remove or isolate any remaining Project Server 2003 instances from untrusted networks.; Restrict authenticated access to Project Server endpoints to trusted users only..

Prepared

Jun 29, 2026, 08:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.