The IBM AppScan reports an XSS vulnerability on Google Analytics regarding the cross-domain tracking query string parameter. I'm trying to address this issue, but:
- I haven't been able to reproduce it, even in non-CSP supporting browsers (specifically IE 9), and,
- I wouldn't know how to fix it if I could reproduce it, given that it's not in any code that I control.
Has anyone else seen this issue reported? Can I safely assume that it's a false positive?