The original CVE has been amended[1] since having *action in the route is not the only attack vector.

[1]https://groups.google.com/forum/#!topic/rubyonrails-security...