A CSRF vulnerability in the Jenkins Multijob Plugin permits an attacker who can send a crafted request to a logged‑in user to resume a previously failed multijob build. The unauthorized resumption can trigger downstream steps or cause unintended job executions, potentially compromising the integrity of continuous‑integration pipelines. The flaw does not provide arbitrary code execution but may lead to accidental or malicious re‑execution of jobs that were intended to fail.

The vulnerability affects Jenkins Multijob Plugin versions 662.vd2e0001f6b_b_d and older. These plugin versions are deployed in Jenkins automation environments where multiple job executions are orchestrated together.

The CVSS score of 4.3 indicates moderate severity. Because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the likelihood of exploitation remains uncertain. Based on the description, the likely attack vector involves a remote attacker submitting a crafted HTTP request that bypasses CSRF protection; the inference is that the attacker would need to target an authenticated Jenkins user with permissions to resume builds.