Brett Moore has reported a security Issue in Microsoft Project Server, which can be exploited by malicious users to gain knowledge of sensitive information.

The problem is that POST requests sent to projectserver/logon/pdsrequest.asp can be exploited to gain knowledge of the username and password of the MSProjectUser account.

The security issue is reported in Microsoft Project Server 2003. Other versions may also be affected.

Solution
Grant access to trusted users only.

Provided and/or discovered by
Brett Moore, Security-Assessment.com.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051316.html

Deep Links
Links available to Secunia VIM customers