CWE-107, Struts: Unused Validation Form, is less an attack than a smell. MITRE's description is one line: an unused validation form indicates that validation logic is not up-to-date.
How it happens
A validation form is defined in the Struts validation configuration, but nothing in the application refers to it. Typical causes are a renamed action form, a removed screen, or a form whose name was changed on one side only.
<form name="oldRegisterForm">
<field property="email" depends="required,email"/>
</form>
<!-- No action mapping uses oldRegisterForm any more -->
The risk is indirect. If the real form was renamed, the rules may not follow it, and the live form has lost its checks while a dead one holds them.
What an attacker gains
MITRE lists the consequence as quality degradation. That is the honest answer: the entry itself is a maintenance problem. Its security value is as a signal that validation configuration and code have drifted apart, so related weaknesses such as unvalidated forms and fields deserve a look.
How to find it
List the form names in the validation configuration and compare them to the form names used by action mappings. Anything that appears only in the first list is unused.
How to fix it
MITRE's mitigation is to remove the unused validation form from the validation configuration. Before deleting, confirm that no live form was supposed to use it. If one was, fix the name instead of removing the rules.
Quick check
Why care about a form that nothing uses?
It may be the leftover half of a rename. The live form could be missing the rules that the unused one still carries.
