Rule Definition
When a validation form field is not associated to java class field, this indicate that the validation logic is not properly maintained and can result in a weakness. Input validation is required to secure an application. Moreover, the web interface is exposed to anyone. Non validating input may allow injecting arbitrary web script, HTML, SQL... Consequences can be severe, like erasing the content of a database.

Remediation
Update the "ActionClass"-validation.xml's entries according to java classes used in your application and review the validation logic of the validation form.

Violation Code Sample

public class Register extends ActionSupport {
  private String username;
  private String password; 
  private String firstName;
  private String lastName;
  private String email;
  private boolean receiveJunkMail;

  public String execute(){
    User user = new User();
    user.setPassword( getPassword() );
    user.setUsername( getUsername() );
    user.setFirstName( getFirstName());
    user.setLastName( getLastName() );
    user.setEmail(getEmail());

    System.out.println("junkmail = " + isReceiveJunkMail());

    return SUCCESS;
  }
}

Register-validation.xml
<validators>
  <field name="username">
      <field-validator type="requiredstring">
           <message >Username is required.</message>
      </field-validator>
      <field-validator type="stringlength">
         <param name="maxLength">8</param>
         <param name="minLength">5</param>
         <message>While ${username} is a nice name, a valid username must be between ${minLength} and ${maxLength} characters long. </message>
     </field-validator>
  </field> /* VIOLATION: the portfolioName is not associated to any Register class field */
  <field name="portfolioName">
      <field-validator type="requiredstring">
         <message key="portfolioName.required"/>
     </field-validator>
  </field>
   <field name="email">
      <field-validator type="requiredstring">
          <message>You must enter a value for email.</message>
      </field-validator>
       <field-validator type="email">
         <message key="email.invalid"/>
      </field-validator>
   </field>
  <validator type="expression">
      <param name="expression">username != password</param>
      <message>Username and password can't be the same.</message>
  </validator>
</validators>

Fixed Code Sample

Register-validation.xml
<validators>
  <field name="username">
      <field-validator type="requiredstring">
           <message >Username is required.</message>
      </field-validator>
      <field-validator type="stringlength">
         <param name="maxLength">8</param>
         <param name="minLength">5</param>
         <message>While ${username} is a nice name, a valid username must be between ${minLength} and ${maxLength} characters long. </message>
     </field-validator>
  </field> /* FIXED: remove the validator field portfolioName */
   <field name="email">
      <field-validator type="requiredstring">
          <message>You must enter a value for email.</message>
      </field-validator>
       <field-validator type="email">
         <message key="email.invalid"/>
      </field-validator>
   </field>
  <validator type="expression">
      <param name="expression">username != password</param>
      <message>Username and password can't be the same.</message>
  </validator>
</validators>

http://cwe.mitre.org/data/definitions/110.html