Timeline for CVSS Score for self-XSS (stored XSS)
Current License: CC BY-SA 4.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 27, 2019 at 13:56 | comment | added | user163495 | If you can assert that a vulnerability will never be a problem, then yes, the impact is zero. I believe that this way of thinking will lead to unpatched vulnerabilities, and problems down the line. Feel free to downvote though if you believe that this answer is flat-out wrong or otherwise adds no value. | |
| May 27, 2019 at 13:51 | comment | added | paj28 | CVSS is for assessing vulnerabilities that exist now, not theoretical ones. As you've shown no interest in improving your answer I'm going to downvote now. | |
| May 27, 2019 at 13:50 | comment | added | user163495 | And I explained in detail that, while at the moment it might seem irrelevant, it might be that in the future additional functionality is added that would turn a self-XSS into a regular XSS. | |
| May 27, 2019 at 13:48 | comment | added | paj28 | Please consult my answer. I disagree with many parts. The low to high vuln was not in the question. In the high to low you basically say "this is same as low to high and the impact is loss of admin's session token" I disagree with so much there it's difficult to label precise statements. OP's question was about self-XSS not loss of admin session token. | |
| May 27, 2019 at 13:32 | comment | added | user163495 | @paj28 Yes, I agree. That's why gave examples. Could you please highlight any specific statements you disagree with? | |
| May 27, 2019 at 13:25 | comment | added | paj28 | Hi, I'm not going to downvote as your answer is considered, but I completely disagree with it. In particular, impacts should be specifically about the impact due to the vulnerability being assessed, and not about the general sensitivity of the data that the system handles. | |
| May 27, 2019 at 11:54 | history | edited | user163495 | CC BY-SA 4.0 |
Quoted questions
|
| May 27, 2019 at 10:10 | vote | accept | NShani | ||
| May 27, 2019 at 17:55 | |||||
| May 27, 2019 at 9:04 | history | answered | user163495 | CC BY-SA 4.0 |