# Vulnerability Management Models Using a Common Vulnerability Scoring System
## 6 Results
### Analysis of the Results for Environment A
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**No.** & **Asset** & **CVE Id** & **Type** & **CVSS 3.x Base** \\ \hline
1. & \(A_{2}\) & CVE-2019-13224 & Use After Free & 9.8 \\ \hline
2. & \(A_{2}\) & Nessus-143449 & PHP 7.3.x \textless{} 7.3.25/7.4.x \textless{} 7.4.13 & 9.8 \\ \hline
3. & \(A_{2}\) & CVE-2019-11043 &
\begin{tabular}{c} Out-of-bounds Write \\ Classic Buffer Overflow \\ \end{tabular} & 9.8 \\ \hline
4. & \(A_{2}\) & CVE-2020-7061 & **Out-of-Bounds Read** & 9.1 \\ \hline
5. & \(A_{2}\) & CVE-2020-7065 & PHP 7.3.x \textless{} 7.3.16 & 8.8 \\ \hline
6. & \(A_{2}\) & Nessus-129557 &
\begin{tabular}{c} Heap-Based \\ Remote Code Execution Vulnerability \\ \end{tabular} & 8.1 \\ \hline
7. & \(A_{2}\) & Nessus-142591 & PHP \textless{} 7.3.24 & 7.5 \\ \hline
8. & \(A_{2}\) & Nessus-140532 & PHP 7.2.x \textless{} 7.3.2x \textless{} 7.3.22 & 7.5 \\ \hline
9. & \(A_{2}\) & CVE-2020-7062 & NULL Pointer Dereference & 7.5 \\ \hline
10. & \(A_{2}\) & CVE-2021-21702 & NULL Pointer Dereference & 7.5 \\ \hline
11. & \(A_{3}\) & CVE-2020-7067 & PHP Out-of-Bounds Read Vulnerability & 7.5 \\ \hline
12. & \(A_{21}\) & CVE-2016-2183 & SWEST32 & 7.5 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Critical and high vulnerabilities according to the base CVSS 3.x score for environment A. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**No.** & **Asset** & **CVE Id** & **Type** & **CVSS 3.x Env** \\ \hline
1. & \(A_{2}\) & CVE-2019-13224 & Use After Free & 9.8 \\ \hline
2. & \(A_{2}\) & Nessus-143449 & PHP 7.3.x \textless{} 7.3.25/7.4.x \textless{} 7.4.13 & 9.8 \\ \hline
3. & \(A_{2}\) & CVE-2019-11043 &
\begin{tabular}{c} Out-of-bounds Write \\ Classic Buffer Overflow \\ \end{tabular} & 9.8 \\ \hline
4. & \(A_{2}\) & CVE-2020-7061 & Out-of-Bounds Read & 9.6 \\ \hline
5. & \(A_{2}\) & Nessus-142591 & PHP \textless{} 7.3.24 & 9.4 \\ \hline
6. & \(A_{2}\) & Nessus-140532 & PHP \textless{} 7.3.2x \textless{} 7.3.22 & 9.4 \\ \hline
7. & \(A_{2}\) & CVE-2020-7062 & NULL Pointer Dereference & 9.4 \\ \hline
8. & \(A_{2}\) & CVE-2021-21702 & NULL Pointer Dereference & 9.4 \\ \hline
9. & \(A_{2}\) & CVE-2020-7065 &
\begin{tabular}{c} Out-of-Bounds Write \\ Stack-based Buffer Overflow \\ \end{tabular} & 8.8 \\ \hline
10. & \(A_{2}\) & Nessus-129557 &
\begin{tabular}{c} Heap-Based \\ Remote Code Execution Vulnerability \\ \end{tabular} & 8.1 \\ \hline
11. & \(A_{1}\) & Nessus-142591 & PHP \textless{} 7.3.25/7.4.x \textless{} 7.3.16 & 8.8 \\ \hline
12. & \(A_{21}\) & CVE-2016-2183 & SWEST32 & 7.5 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Critical and high vulnerabilities according to the CVSS 3.x environmental assessment for environment A. When analyzing the results obtained for environment A, the estimated work hours for CVSS 2.0 (\(T_{FIX_{MAX}}\), \(T_{FIX_{AVERAGE}}\), and \(T_{FIX_{MIN}}\)) were reduced to the scanning time (\(T_{S}\)) only, thereby showing a profit of over 93%. For CVSS 3.x, the number of estimated work hours decreased proportionally by approximately 7% for each investigated case.