The issue allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor, resulting in the instantiation of potentially unsafe objects once discarded by an administrator. This is possible because when deserialization fails due to invalid data, Jenkins stores invalid object references created through XML REST APIs in the Old Data Monitor. If an administrator discards the old data, some erroneous data submitted to these endpoints may be persisted. Attackers with View/Create, Job/Create, Agent/Create, or their respective */Configure permissions can exploit this.