CVE-2022-47930
IO FinNet tss-lib vulnerable to replay attacks involving proofs
Record from NVD · Published April 21, 2023
An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session id, context, or random nonce in the generation of the challenge. This could allow a malicious user or an eavesdropper to replay a valid proof sent in the past.
EPSS 0.52% · 44.4th percentile
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| iofinnet | tss-lib | 0 |
Timeline
- Apr 21, 2023 CVE Published
- Apr 22, 2023 EPSS Score (30 in total, the first dated here)
- Feb 5, 2025 CVE Updated
- May 24, 2026 Coalition ESS Score
- Jun 1, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2022-47930
vulnetix vdb fixes CVE-2022-47930Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2022-47930/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart