An attacker must initially have the account access or some kind of other cookie stealing vulnerability in order to execute this attack. So ig this is low/informative