Language: JavaScript
Label: safe
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
        registerNewCustomerAction: function () {
            var $newCustomerButton = $('#add-new-customer');
            var isPimcoreAvailable = ('undefined' !== typeof window.top.pimcore);
            if(!isPimcoreAvailable) $newCustomerButton.hide();
            $newCustomerButton.on('click', function (e) {
                if (!isPimcoreAvailable) {
                    app.Logger.error(
                        'Pimcore is not available (e.g. backend opened outside iframe) - can\'t load object with ID',
                        objectId
                    );
                    return false;
                }
                $.ajax({
                    method : 'POST',
                    url: '/admin/customermanagementframework/customers/new',
                    headers: {
                        'X-Pimcore-Csrf-Token': $newCustomerButton.data('token')
                    },
                    success: function (data) {
                        var objectId = data.id;
                        if ('undefined' !== typeof window.top.pimcore) {
                            window.top.pimcore.helpers.openObject(objectId, 'object');
                        } else {
                            app.Logger.error(
                                'Pimcore is not available (e.g. backend opened outside iframe) - can\'t load object with ID',
                                objectId
                            );
                        }
                    }
                });
            });
        }
    });
})(jQuery);