← Vulnerability feed

Vulnerability record · CVE-2006-6617 · published 18 December 2006

CVE-2006-6617: Microsoft project server vulnerability

Microsoft · Project Server

projectserver/logon/pdsrequest.asp in Microsoft Project Server 2003 allows remote authenticated users to obtain the MSProjectUser password for a SQL database via a GetInitializationData request, which includes the information in the UserName and Password tags of the response.

6.5 CVSS 2.0 Medium EPSS 20% · top 2.6%
6.5CVSS 2.0 base score
20%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
16References
16 Jun 2026Last modified by NVD

Description

projectserver/logon/pdsrequest.asp in Microsoft Project Server 2003 allows remote authenticated users to obtain the MSProjectUser password for a SQL database via a GetInitializationData request, which includes the information in the UserName and Password tags of the response.

AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051316.html
http://secunia.com/advisories/23391
http://securityreason.com/securityalert/2047
http://securitytracker.com/id?1017388
http://www.securityfocus.com/archive/1/454497/100/0/threaded
http://www.securityfocus.com/bid/21611
http://www.vupen.com/english/advisories/2006/5038
https://exchange.xforce.ibmcloud.com/vulnerabilities/30905
http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051316.html
http://secunia.com/advisories/23391
http://securityreason.com/securityalert/2047
http://securitytracker.com/id?1017388
http://www.securityfocus.com/archive/1/454497/100/0/threaded
http://www.securityfocus.com/bid/21611
http://www.vupen.com/english/advisories/2006/5038
https://exchange.xforce.ibmcloud.com/vulnerabilities/30905

Track CVE-2006-6617 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2015-2503Microsoft access permissions and access controls vulnerabilityMicrosoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007…EPSS 17%9.3CVE-2009-0102Microsoft office project vulnerabilityMicrosoft Project 2000 SR1 and 2002 SP1, and Office Project 2003 SP3, does not properly handle memory allocation for Project files, which allows remo…EPSS 24%9.0CVE-2014-0251Microsoft office web apps server code injection vulnerabilityMicrosoft Windows SharePoint Services 3.0 SP3; SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 Gold and SP1; SharePoint Foundation 2010 SP1 an…EPSS 14%8.8CVE-2018-0944Microsoft project server cross-site scripting vulnerabilityMicrosoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially…EPSS 4.5%8.8CVE-2018-0909Microsoft project server cross-site scripting vulnerabilityMicrosoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially …EPSS 4.5%8.8CVE-2018-0910Microsoft project server cross-site scripting vulnerabilityMicrosoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially …EPSS 4.5%8.8CVE-2018-0911Microsoft project server cross-site scripting vulnerabilityMicrosoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially …EPSS 4.5%8.8CVE-2018-0912Microsoft project server cross-site scripting vulnerabilityMicrosoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially …EPSS 4.5%

Source: NIST National Vulnerability Database (record CVE-2006-6617), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.