Until the fix everything was possible.

I think they meant "within this few weeks period you could not fixate CSRF token"