We are running vulnerability scans on our systems. I can see a few XSS vulnerabilities being reported, such as CVE-2020-14173. Let me quote:
If this is a internal (not exposed to the Internet) system could I safely assume that the severity for such vulnerability could be decreased? I mean, if a bad actor has already gained an initial foothold, I could imagine that he would use other techniques to escalate privileges.
Are my assumptions valid?