For example, CWE-491 (Public cloneable() Method Without Final (aka 'Object Hijack')) is classified under the "Insufficient Encapsulation" kingdom (CWE-485), but it is also a fairly clear example of another kingdom, "API Abuse" (CWE-227). Path Manipulation (CWE-249) is described as a low-level variant of a buffer overflow (CWE-120), and it is in the same Input Validation kingdom; however, CWE-251 (Often Misused: String Management) also identifies the risk of string manipulation functions that enable buffer overflows, but it is classified under CWE-227 (API Abuse) instead. The rationale for these classification choices is not immediately clear.
CWE-699 does not aim to be mutually exclusive. Instead, it uses diverse categories with many relationships. However, as explained previously, this has implications for repeatability.
While CWE-1000 has mutual exclusivity as a goal, it has been difficult to accomplish. It tries to reduce overlap as much as possible. The explicit modeling of chains and composites has simplified this problem somewhat. However, there are still multiple perspectives embedded within the hierarchy, and not all chains or composites have been detected.
Models Inter-Relationships