Security Resilience

CVE-2023-28077

Info Disclosure in Dell Bsafe Ssl-J 6.0 – 6.5.1

Info Disclosure
Published
10 February 2024
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 4.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0018 7th percentile
Risk Priority 34 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-28077 is a medium-severity Debug Messages Revealing Unnecessary Information (CWE-1295) vulnerability in Dell Bsafe Ssl-J. Its CVSS base score is 4.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

Dell BSAFE SSL-J, versions prior to 6.5, and versions 7.0 and 7.1 contain a debug message revealing unnecessary information vulnerability. This may lead to disclosing sensitive information to a locally privileged user.

CWE(s)
CWE-1295CWE-200

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003 OS Credential Dumping Credential Access
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.
attack.mitre.org →
T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1003.003 NTDS Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
attack.mitre.org →
T1003.006 DCSync Credential Access
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citati…
attack.mitre.org →
T1016 System Network Configuration Discovery Discovery
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.
attack.mitre.org →
T1020.001 Traffic Duplication Exfiltration
Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-29171Same product: Dell Bsafe Ssl-J
CVE-2024-29172Same product: Dell Bsafe Ssl-J
CVE-2026-44276Same vendor: Dell
CVE-2025-36601Same vendor: Dell
CVE-2024-48011Same vendor: Dell
CVE-2023-32476Same vendor: Dell
CVE-2026-23777Same vendor: Dell
CVE-2026-80356Same vendor: Dell
CVE-2024-28963Same vendor: Dell
CVE-2025-38746Same vendor: Dell

Affected Assets

dell
bsafe ssl-j
6.0 — 6.5.1 · 7.0 — 7.1.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 3 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V13.4.2

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Access enforcement directly stops unauthorized actors from obtaining sensitive information.

AC-4 Information Flow Enforcement good match

Information flow enforcement structurally prevents sensitive data from reaching unauthorized recipients.

SC-28 Protection of Information at Rest good match

Protection of information at rest prevents unauthorized exposure of stored sensitive data.

SC-8 Transmission Confidentiality and Integrity good match

Transmission confidentiality mechanisms stop exposure of sensitive data on the wire.

AC-6 Least Privilege good match

Least privilege reduces the set of actors who can reach sensitive information.

SI-11 Error Handling good match

SI-11 requires error messages (including debug/diagnostic output) to avoid exposing exploitable system details, directly stopping the described information leakage.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-01 partial match
blocks

Configuration baselines can disable debug output in production, partially preventing exposure of sensitive details.

PR.PS-06 partial match
blocks

Secure SDLC practices directly require sanitizing or removing debug messages that leak internal information.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.10 Acceptable use of information and other associated assets partial match
blocks

A.5.10 only requires awareness, a topic-specific acceptable-use policy stating expected behaviours/monitoring, and procedures referencing classification and other controls; per the owner's explicit rule on labelling and similar dependency-style clauses, this does not itself prevent exposure (CWE-200) unless access/DLP/etc. act on it.

A.5.11 Return of assets partial match
blocks

Requiring the return of all physical and electronic assets plus secure deletion of organizational data from personal devices reduces the chance that sensitive information remains accessible to departing personnel.

A.5.12 Classification of information partial match
blocks

A.5.12 only defines and communicates a classification scheme so that protection needs can be understood; per the owner's explicit rule, labeling/classification does not itself prevent exposure and requires other controls (e.g. access enforcement) to act on it.

A.5.13 Labelling of information partial match
blocks

By requiring classification labels and metadata on all information assets, the control makes it harder for sensitive data to be inadvertently exposed because downstream systems and users can recognize and enforce handling rules based on those labels.

A.5.14 Information transfer partial match
blocks

Requiring encryption, access controls, and recipient authentication for transfers directly reduces the chance that sensitive data reaches an unauthorized observer.

A.5.17 Authentication information partial match
blocks

Secure delivery, protected storage, and confidentiality of allocation records limit exposure of authentication material to unauthorized observers.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).

Windows 10 (1 rule)
  • V-220967 The Debug programs user right must only be assigned to the Administrators group. blocks CWE-1295
Windows Server 2016 (1 rule)
  • V-225079 The Debug programs user right must only be assigned to the Administrators group. blocks CWE-1295
Windows Server 2019 (1 rule)
  • V-205757 Windows Server 2019 Debug programs: user right must only be assigned to the Administrators group. blocks CWE-1295

References