From CVSS v2 complete guide :

"SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the impact to a user's system could be much greater than the impact to the target host. However, this is an indirect impact. Cross-site scripting vulnerabilities should be scored with no impact to confidentiality or availability, and partial impact to integrity."

I know cross-site scripting is divided into 3 main types: reflected XSS, stored XSS and DOM-based XSS.
However, why does XSS should be scored with PARTIAL impact to integrity instead of NO impact to integrity  ? If an XSS vulnerability is a reflected XSS, can the XSS be scored with no impact to integrity  ?

From CVSS v2 complete guide :

"SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the impact to a user's system could be much greater than the impact to the target host. However, this is an indirect impact. Cross-site scripting vulnerabilities should be scored with no impact to confidentiality or availability, and partial impact to integrity."

I know cross-site scripting is divided into 3 main types: reflected XSS, stored XSS and DOM-based XSS.
However, why is XSS scored with PARTIAL impact to integrity instead of NO impact to integrity? If an XSS vulnerability is a reflected XSS, can the XSS be scored with no impact to integrity?

From CVSS v2 complete guide :

"SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the impact to a user's system could be much greater than the impact to the target host. However, this is an indirect impact. Cross-site scripting vulnerabilities should be scored with no impact to confidentiality or availability, and partial impact to integrity."

I know cross-site scripting is divided into 3 main types: reflected XSS, stored XSS and DOM-based XSS.
However, why does XSS should be scored with PARTIAL impact to integrity instead of NO impact to integrity ? Even an XSS vulnerability is a reflected XSS, can the XSS be scored with partial impact to integrity ?

From CVSS v2 complete guide :

"SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the impact to a user's system could be much greater than the impact to the target host. However, this is an indirect impact. Cross-site scripting vulnerabilities should be scored with no impact to confidentiality or availability, and partial impact to integrity."

I know cross-site scripting is divided into 3 main types: reflected XSS, stored XSS and DOM-based XSS.
However, why does XSS should be scored with PARTIAL impact to integrity instead of NO impact to integrity ? If an XSS vulnerability is a reflected XSS, can the XSS be scored with no impact to integrity ?

From CVSS v2 complete guide :

"SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the impact to a user's system could be much greater than the impact to the target host. However, this is an indirect impact. Cross-site scripting vulnerabilities should be scored with no impact to confidentiality or availability, and partial impact to integrity."

I know cross-site scripting is divided into 3 main types: reflected XSS, stored XSS and DOM-based XSS.
However, why does XSS should be scored with PARTIAL impact to integrity instead of NO impact to integrity ?

From CVSS v2 complete guide :

"SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the impact to a user's system could be much greater than the impact to the target host. However, this is an indirect impact. Cross-site scripting vulnerabilities should be scored with no impact to confidentiality or availability, and partial impact to integrity."

I know cross-site scripting is divided into 3 main types: reflected XSS, stored XSS and DOM-based XSS.
However, why does XSS should be scored with PARTIAL impact to integrity instead of NO impact to integrity ? Even an XSS vulnerability is a reflected XSS, can the XSS be scored with partial impact to integrity ?