A CVE is a vulnerability description, ie. a document stating that some security property has been found to be broken.
As explained in Ohnana's comment, a CVE might indeed state that to be exploitable some other security properties not part of this CVE should also be broken (typically CVE requiring a specific access from the attacker, whether it is local, privileged, in position to tamper network traffic, etc.).
However the CVE will not limit this to the use of another specific CVE. It will not tell for instance that this CVE is exploitable if a local access has been gained by using specifically this other CVE. It will just say that this CVE is only exploitable with a local access.
However, while there is not strict dependency between CVEs, there can still be a kind of link between them because, when an important enough (or suspected to be important) vulnerability is discovered in some widespread software, a lot of security researchers will dig into this and possibly make other discoveries.
Then, it will be up to determine how such discoveries should be classified:
In the scheme you describe, which I understand as "using this vulnerability allows the attacker to do even more harm as previously expected by proceeding in a certain way", this will most likely ends-up as an update of the first CVE. It means that the vulnerability's impact seems to have been underestimated and needs to be revised.
However, most often such discoveries are independent vulnerabilities. Each of them will get its own CVE and can be exploited independently. However it is possible that the same fix can solve several of such CVEs since they are likely to concern the same part of the software (the one under scrutiny by all security researchers). This is useful because it will help to increase the fix quality. Shellshock with its list of CVEs published after the first discovery seems a good example.
At last it is also possible that several discovered issues, while being independent from each other and not necessarily being all security issues (and therefore not needing a distinct CVE), may combine to increase the initial CVE threat. For instance, CVE-2015-3456 mentions a vulnerability affecting Qemu's Floppy Disk Controller in some versions of Xen and KVM and allowing to escape the VM; while this issue should be restricted to environment having floppy drive emulation enabled, researchers have discovered that "if the administrator explicitly disables the virtual floppy drive, an unrelated bug causes the vulnerable FDC code to remain active and exploitable by attackers".
