# CVE-2024-13066: Akinsoft LimonDesk clickjacking in UI layers

Source: https://junglewise.ai/threats/cve-2024-13066-akinsoft-limondesk-clickjacking-in-ui-layers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-03. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2024-13066 · Severity: medium · CVSS 4.3 · Published 2025-09-03

Akinsoft LimonDesk, a customer support and help desk software, is vulnerable to clickjacking. This security flaw allows an attacker to trick authorized users into performing unintended actions by overlaying the legitimate interface with a hidden, malicious layer. This could lead to unauthorized configuration changes or data manipulation if an administrative user is successfully targeted.

Technologies: [AKINSOFT LimonDesk](https://junglewise.ai/threats/technologies/limondesk). Vendors: [AKINSOFT](https://junglewise.ai/threats/vendors/akinsoft).

## Quick answers

**Is CVE-2024-13066 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-13066 being exploited in the wild.

**How severe is CVE-2024-13066?** Medium severity, with a CVSS score of 4.3, published 3 September 2025.

**Which products and versions are affected?** AKINSOFT LimonDesk s1.02.14 to v1.02.17.

**Is there a fix for CVE-2024-13066?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-13066 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2024-13066?** Check whether you run AKINSOFT LimonDesk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Akinsoft LimonDesk versions s1.02.14 through v1.02.17 contain a clickjacking vulnerability (CWE-1021). The application fails to properly implement security headers such as X-Frame-Options or Content-Security-Policy (CSP) 'frame-ancestors' directives, allowing the UI to be embedded in an unauthorized iframe. An attacker can leverage this to perform an iFrame Overlay attack (CAPEC-103), tricking a high-privileged user into clicking hidden UI elements. Exploitation requires the attacker to convince an authenticated user to visit a malicious webpage. The vulnerability was addressed in version 1.02.17.

## Affected products

- Akinsoft LimonDesk s1.02.14 to v1.02.17

## Timeline

- 2025-09-03: disclosed
- 2025-09-03: advisory

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0206](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0206)
- [https://www.usom.gov.tr/bildirim/tr-25-0206](https://www.usom.gov.tr/bildirim/tr-25-0206)

## Related threats

- [Akinsoft LimonDesk authentication bypass via excessive login attempts](https://junglewise.ai/threats/cve-2025-2416-akinsoft-limondesk-authentication-bypass-via-excessive-login)
- [Akinsoft LimonDesk Cross-Site Scripting](https://junglewise.ai/threats/cve-2025-0878-akinsoft-limondesk-cross-site-scripting)
- [Akinsoft LimonDesk forceful browsing via origin validation error](https://junglewise.ai/threats/cve-2024-13068-akinsoft-limondesk-forceful-browsing-via-origin-validation-error)