The vulnerability exists in a client interface of HPE ClearPass Policy Manager and allows an unauthenticated attacker to inject malicious DOM‑based payloads that are executed as arbitrary JavaScript within a victim’s browser session. Successful exploitation enables the attacker to run arbitrary code in the victim’s browser context for the affected interface, potentially allowing session hijacking, credential theft, or other client‑side attacks. The attack vector is inferred to be remote access to the client interface; this conclusion is drawn directly from the description.

The affected product is Hewlett Packard Enterprise ClearPass Policy Manager (CPPM). No specific versions were listed, so all customer deployments of the client interface may be impacted until an update is applied.

The CVSS base score is 5.4, reflecting a medium impact, and the EPSS score is not available; the vulnerability is not listed in CISA KEV. An attacker must reach the client interface over the network and a victim must interact with the page, but no privileged escalation is required. The requirement that the attacker reach the client interface over the network and the victim view the page is inferred from the description of the vulnerability. The overall risk is moderate, and mitigation should be prioritized.