OpenAM 13.0.0 includes Commons Fileupload 1.2.2. So, CVE-2016-3092 may affect Apach Click library that are used for initial configuration.