The IBM AppScan reports an XSS vulnerability on Google Analytics regarding the cross-domain tracking query string parameter. I'm trying to address this issue, but:

  1. I haven't been able to reproduce it, even in non-CSP supporting browsers (specifically IE 9), and,
  2. I wouldn't know how to fix it if I could reproduce it, given that it's not in any code that I control.

Has anyone else seen this issue reported? Can I safely assume that it's a false positive?


There is an XSS vulnerability reported on google-analytics, more information can be found on the following pages:

Make sure to update your version, when your version of google-analytics is the same to this one reported.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.