If an XSS vulnerability is a reflected XSS, can the XSS be scored with no impact to integrity?
No, the type of the XSS vulnerability doesn't affect the impact metrics at all.
It doesn't matter if an XSS vulnerability is reflected, stored, or DOM-based, or if it requires user interaction, or if an account is required, or ... Those factors are caught by the access complexity and authentication metrics.
why is XSS scored with PARTIAL impact to integrity instead of NO impact to integrity?
When evaluating the impact, only the impact on the host is to be considered:
SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the impact to a user's system could be much greater than the impact to the target host. However, this is an indirect impact. Cross-site scripting vulnerabilities should be scored with no impact to confidentiality or availability, and partial impact to integrity CVSSv2 spec
I can think of two options for the integrity score:
- With XSS, an attacker changes what data a host sends to its user, which is a direct impact on the integrity of the host. An attacker can alter the data, and thus perform various attacks, such as displaying a login form for phishing attacks (an indirect impact on confidentiality which isn't considered in CVSSv2), read out client-side data (like cookies, which again isn't considered as a direct confidentiality impact), etc.
- As @one suggested, an attacker could modify data in a web-application by bypassing CSRF protection, which would have a partial - but obviously not complete - impact on the host. I find this explanation less likely, as it would also imply that there should be an impact on availability (at least for some applications), and may also somewhat imply a confidentiality impact (see my question about that here).