What is simple cross-site scripting in Debian Severity Levels?

[Shamak]

The Debian CVE Severity levels refer to simple cross-site scripting (XSS) as an example of a medium cve.

medium : For anything which permits code execution after user interaction. Local privilege escalation vulnerabilities are in this category as well, or remote privilege escalation if it's constrained to the application (i.e., no shell access to the underlying system, such as simple cross-site scripting). Most remote DoS vulnerabilities fall into this category, too.

https://security-team.debian.org/securi ... ity-levels

Does anyone know what simple cross-site scripting is? I've searched and found reflective and stored XSS. One webstie said those were the two main ones.

Reflected and Stored XSS Attacks

XSS attacks can generally be categorized into two categories: reflected and stored. There is a third, much less well-known type of XSS attack called DOM Based XSS that is discussed separately here.

Reflected XSS Attacks

Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request. Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other website. When a user is tricked into clicking on a malicious link, submitting a specially crafted form, or even just browsing to a malicious site, the injected code travels to the vulnerable web site, which reflects the attack back to the user’s browser. The browser then executes the code because it came from a “trusted” server. Reflected XSS is also sometimes referred to as Non-Persistent or Type-I XSS (the attack is carried out through a single request / response cycle).

Stored XSS Attacks

Stored attacks are those where the injected script is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. The victim then retrieves the malicious script from the server when it requests the stored information. Stored XSS is also sometimes referred to as Persistent or Type-II XSS.

https://owasp.org/www-community/attacks/xss/

I thought that maybe simple XSS might be the reflective type as it seems to require interaction from the user and so would fit under the medium category.

[Teebarmar]

I found cross site scripting but not simple cross site scripting

cross site scripting

A cross-site scripting attack is a malicious code injection, which will be executed in the victim’s browser.

https://www.softwaretestinghelp.com/cro ... tack-test/
Under link above look for
Let’s analyze a simple Example: Consider we have a website with a search field. That may help to gain an idea of a simple example of XSS attack.

medium : For anything which permits code execution after user interaction. Local privilege escalation vulnerabilities are in this category as well, or remote privilege escalation if it's constrained to the application (i.e., no shell access to the underlying system, such as simple cross-site scripting). Most remote DoS vulnerabilities fall into this category, too.


"i.e., no shell access to the underlying system, such as simple cross-site scripting"

May be it needs to be red like "No shell acccess to the underlying system"

[Shamak]

Maybe. Thanks.