CVEs are for vulnerabilities in software that is shipped and then consumed, not for vulnerabilities in services (e.g. websites). So if a vulnerability in the service (e.g. a website) is in something that is widely available as a software package (e.g. a flaw that is at its root in Apache, or PHP or WordPress for example) then the flaw within that software package would get a CVE.
If the flaw is in a service that is a custom written piece of software that is not available for download (e.g. Amazon, eBay, etc.) then that vulnerability would not get a CVE.
Ultimately the goal of CVE is to provide an identifier for a vulnerability so that when multiple organizations (e.g. the reporter and the upstream and the community using it) need to discuss the vulnerability they can all be sure they're actually talking about the same thing.