A serious security problem on the online retailer's web sites allowed attacks on session cookies and therefore access to customer accounts

From The H:

The exploit was trivial. All that was required was to make a post in the customer forum with a specially formatted title along the lines of ">alert('XSS'). Since Amazon didn't sufficiently check the post title, the JavaScript code in the title was then embedded in some of the forum's subpages and executed by browsers when those pages were opened.

The pages with the injected code could be directly linked to, allowing malicious users to send the links by email, and could also be accessed directly from the forum. Amazon certainly could have quickly deleted the prepared forum posts with unusual titles, but that didn't happen. One public post that was part of the test stayed up for weeks without being discovered.

 Critical security vulnerability at Amazon fixed