Google Blogoscoped

Forum

Security issue in Website Optimizer

WebSonic.nl [PersonRank 10]

Tuesday, December 7, 2010
14 years ago5,944 views

Just got an email from Google,

<<We are writing to inform you of a potential security issue with Website Optimizer. By exploiting a vulnerability in the Website Optimizer Control Script, an attacker might be able to execute malicious code on your site using a Cross-Site Scripting (XSS) attack. This attack can only take place if a website or browser has already been compromised by a separate attack. While the immediate probability of this attack is low, we urge you to take action to protect your site.

We have fixed the bug, and all new experiments are not susceptible. However, any experiments you are currently running need to be updated to fix the bug on your site. Additionally, if you have any Website Optimizer scripts from paused or stopped experiments created before December 3, 2010, you will need to remove or update that code as well.

There are two ways to update your code. You can either stop current experiments, remove the old scripts, and create a new experiment, or you can update the code on your site directly. We strongly recommend creating a new experiment as it is the simpler method.>>

<<Your experiment will continue as normal after you’ve made this update. There’s no need to pause or restart the experiment.

We’re committed to keeping Website Optimizer secure, and we’re deeply sorry for this issue. We will continue to work hard to prevent future vulnerabilities.>>

Juha-Matti Laurio [PersonRank 10]

14 years ago #

Also at

http://thelostagency.wordpress.com/2010/12/07/security-issue-in-website-optimizer-2455518/

Juha-Matti Laurio [PersonRank 10]

14 years ago #

http://websiteoptimizer.blogspot.com/2010/12/update-your-website-optimizer-scripts.html

Juha-Matti Laurio [PersonRank 10]

14 years ago #

http://www.securityfocus.com/bid/45310

Forum home

Advertisement

 
Blog  |  Forum     more >> Archive | Feed | Google's blogs | About
Advertisement

 

This site unofficially covers Google™ and more with some rights reserved. Join our forum!