The IBM AppScan reports an XSS vulnerability on Google Analytics regarding the cross-domain tracking query string parameter. I'm trying to address this issue, but:

  1. I haven't been able to reproduce it, even in non-CSP supporting browsers (specifically IE 9), and,
  2. I wouldn't know how to fix it if I could reproduce it, given that it's not in any code that I control.

Has anyone else seen this issue reported? Can I safely assume that it's a false positive?

1 Answer 1


There is an XSS vulnerability reported on google-analytics, more information can be found on the following pages:

Make sure to update your version, when your version of google-analytics is the same to this one reported.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .