An unauthenticated user can execute the attack, and there’s no mitigation, just a hotfix that should be applied immediately.