Rule Definition
Disabling the validation of a form expose this action to various types of attacks such as SQL Injection, Command Injection, Cross-Site Scripting, Denial of Service... This is due to the fact that invalidated input may allow injecting arbitrary web script, HTML, SQL... Consequences can be severe, like deletion of the entire content of a database. Input validation is mandatory to secure an application. Moreover, the web interface is exposed to anyone.

Remediation
Enable the validation.

Violation Code Sample

----> struts-config.xml:
...
<action path="/submit"
             type="submit.SubmitAction"
             name="submitForm" input="/submit.jsp"
             scope="request" 
             validate="false"> // VIOLATION
    <forward name="success" path="/submit.jsp"/>
    <forward name="failure" path="/submit.jsp"/>
</action>
...

Fixed Code Sample

----> struts-config.xml:
...
<action path="/submit"
             type="submit.SubmitAction"
             name="submitForm" input="/submit.jsp"
             scope="request"
             validate="true"> // FIXED
    <forward name="success" path="/submit.jsp"/>
    <forward name="failure" path="/submit.jsp"/>
</action>
...

Note also that the absence of validate attribute is interpreted as validate="true"

http://cwe.mitre.org/data/definitions/109.html