Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing…

{
                    "vendor": "Jenkins Project",
                    "product": "Jenkins",
                    "versions": [
                        {
                            "version": "2.588",
                            "versionType": "maven",
                            "lessThan": "*",
                            "status": "unaffected"
                        },
                        {
                            "version": "2.580.2",
                            "versionType": "maven",
                            "lessThan": "2.580.*",
                            "status": "unaffected"
                        }
                    ],
                    "defaultStatus": "affected"
                }