1439
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 901 SFP Primary Cluster: Privilege 888 2386
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1418 Comprehensive Categorization: Violation of Secure
Design Principles
1400 2549
Notes
Relationship
There is a close association with CWE-250 (Execution with Unnecessary Privileges).
CWE-653 is about providing separate components for each "privilege"; CWE-250 is about
ensuring that each component has the least amount of privileges possible. In this fashion,
compartmentalization becomes one mechanism for reducing privileges.
Terminology
The term "Separation of Privilege" is used in several different ways in the industry, but they
generally combine two closely related principles: compartmentalization (this node) and using only
one factor in a security decision (CWE-654). Proper compartmentalization implicitly introduces
multiple factors into a security decision, but there can be cases in which multiple factors are
required for authentication or other mechanisms that do not involve compartmentalization,
such as performing all required checks on a submitted certificate. It is likely that CWE-653 and
CWE-654 will provoke further discussion.
References
[REF-196]Jerome H. Saltzer and Michael D. Schroeder. "The Protection of Information in Computer
Systems". Proceedings of the IEEE 63. 1975 September. < http://web.mit.edu/Saltzer/www/
publications/protection/ >.
[REF-535]Sean Barnum and Michael Gegick. "Separation of Privilege". 2005 December 6. <
https://web.archive.org/web/20220126060047/https://www.cisa.gov/uscert/bsi/articles/knowledge/
principles/separation-of-privilege >.2023-04-07.
[REF-1138]Stewart Smith. "CVE-2019-6260: Gaining control of BMC from the host processor".
2019. < https://www.flamingspork.com/blog/2019/01/23/cve-2019-6260:-gaining-control-of-bmcfrom-
the-host-processor/ >.
CWE-654: Reliance on a Single Factor in a Security Decision
Weakness ID : 654
Structure : Simple
Abstraction : Base
Description
A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single
condition or the integrity of a single object or entity in order to make a decision about granting
access to restricted resources or functionality.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-654: Reliance on a Single Factor in a Security Decision
CWE-654: Reliance on a Single Factor in a Security Decision