Administrative script execution via stored guest-interface input

Stored XSS in HPE Aruba Networking ClearPass Policy Manager allows remote authenticated users to execute script in an administrator's browser. The guest interface persists attacker-controlled content and later renders it in the administrative interface, but HPE has not identified the affected input or missing output-encoding operation. The attacker needs authenticated guest-interface access, and successful exploitation runs arbitrary script in the affected interface's browser context.