privateserver.lan is only accessible from the inside of a firewall, on a private LAN, and not accessible from the internet. It has a limited audience. privateserver.lan reads data from the publicly accessible servers DB (publicserver.com), and does not properly filter output, allowing Stored XSS.
Barring any intentional attacks from users with direct access to privateserver.lan, what are the XSS risks to the data on privateserver.lan, and to the users of privateserver.lan, keeping in mind that outside users are unable to gain access to this server through the firewall?
Also, to be clear, this is something We will be fixing, I'm only trying to assess the risk to determine the priority of the fix.