How severe is CVE-2022-4641?

CVE-2022-4641 has a CVSS 3.x base score of 2.5, rated low severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2022-4641 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-4641?

CVE-2022-4641 affects Pig-vector Project Pig-vector. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-4641?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-4641 published?

CVE-2022-4641 was published on 2022-12-21 and last updated on 2026-06-17.

CVE-2022-4641

CVE-2022-4641 is a low-severity vulnerability in Pig-vector Project Pig-vector with a CVSS 3.x base score of 2.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-377.

Key facts

Severity: Low (CVSS 3.x base score 2.5)
EPSS exploit prediction: 0% (14th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-377
Affected product: Pig-vector Project Pig-vector
Published: 2022-12-21
Last modified: 2026-06-17

Description

A vulnerability was found in pig-vector and classified as problematic. Affected by this issue is the function LogisticRegression of the file src/main/java/org/apache/mahout/pig/LogisticRegression.java. The manipulation leads to insecure temporary file. The attack needs to be approached locally. The name of the patch is 1e7bd9fab5401a2df18d2eabd802adcf0dcf1f15. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216500.

Frequently asked questions

What is CVE-2022-4641?: A vulnerability was found in pig-vector and classified as problematic. Affected by this issue is the function LogisticRegression of the file src/main/java/org/apache/mahout/pig/LogisticRegression.java. The manipulation leads to insecure temporary file. The attack needs to be approached locally. The name of the patch is 1e7bd9fab5401a2df18d2eabd802adcf0dcf1f15. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216500.
How severe is CVE-2022-4641?: CVE-2022-4641 has a CVSS 3.x base score of 2.5, rated low severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2022-4641 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-4641?: CVE-2022-4641 affects Pig-vector Project Pig-vector. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-4641?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-4641 published?: CVE-2022-4641 was published on 2022-12-21 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:pig-vector_project:pig-vector:-:*:*:*:*:*:*:*

Other CWE-377 (Insecure Temporary File) vulnerabilities

CVE-2011-4119 — Critical (CVSS 9.8): caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.
CVE-2012-2666 — Critical (CVSS 9.8): golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a…
CVE-2015-5224 — Critical (CVSS 9.8): The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name…
CVE-2025-14307 — High (CVSS 8.1): An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The…
CVE-2023-43498 — High (CVSS 8.1): In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates…
CVE-2025-46369 — High (CVSS 7.8): Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File…

Browse all CWE-377 (Insecure Temporary File) vulnerabilities →